azure - 使用 Arm 或 Bicep 模板配置 Azure 函数身份验证

Question

我有一个与使用 Arm 或 Bicep 模板配置 Azure 函数身份验证相关的问题。

当我使用门户为 Azure 功能配置身份验证时，会在配置中自动创建 MICROSOFT_PROVIDER_AUTHENTICATION_SECRET。但是，当我使用下面的 Bicep 模板时，不会创建 MICROSOFT_PROVIDER_AUTHENTICATION_SECRET。

我还尝试了 CLI 中的“az webapp auth microsoft update”命令并得到了相同的结果。创建身份验证配置时没有使用 MICROSOFT_PROVIDER_AUTHENTICATION_SECRET

param function1name string = 'testfunctionnum1'
param region string
param srv string = 'xxxxx'

resource site1 'Microsoft.Web/sites@2022-03-01' = {
  name: function1name
  kind: 'functionapp,linux'
  location: region 
  identity:{
    type: 'SystemAssigned'
  }
  properties: {
    // name: function1name
    scmSiteAlsoStopped: false
    clientAffinityEnabled: false
    clientCertEnabled: false
    clientCertMode: 'Required'
    hostNamesDisabled: false
    containerSize: 1536
    dailyMemoryTimeQuota: 0
    httpsOnly: true
    redundancyMode: 'None'
    storageAccountRequired: false
    keyVaultReferenceIdentity: 'SystemAssigned'
    siteConfig: {
      numberOfWorkers:1
      linuxFxVersion:'Python|3.9'
      acrUseManagedIdentityCreds: false
      alwaysOn: false
      http20Enabled: false
      functionAppScaleLimit: 200
      minimumElasticInstanceCount: 0
      ]
    }
    serverFarmId: srv

  }
}


resource fn1config 'Microsoft.Web/sites/config@2022-03-01' = {
  parent: site1
  name: 'web'
  properties:{
    linuxFxVersion: 'PYTHON|3.9'
    ftpsState: 'FtpsOnly'
    
  }
}

resource fn1auth 'Microsoft.Web/sites/config@2022-03-01' = {
  parent: site1
  name: 'authsettingsV2'
  properties:{
    platform: {
      enabled: true
    }
    globalValidation: {
      requireAuthentication: true
      unauthenticatedClientAction: 'Return401'
    }
    identityProviders:{
      azureActiveDirectory:{
        enabled: true
        registration:{
          clientId:'xxx'
          clientSecretSettingName: 'MICROSOFT_PROVIDER_AUTHENTICATION_SECRET'
          openIdIssuer: 'https://sts.windows.net/xxxx/v2.0'
    
        }
        // login:{
        //   disableWWWAuthenticate: false
        // }
        // isAutoProvisioned: false
      }
    }
   login:{
    tokenStore:{
      enabled:true
    }
   } 
  }
}

Answer 1

这是我发现唯一有效的方法。希望 Bicep 能够尽快创建 AD 应用程序，因为这非常令人沮丧。

您可以使用 Azure CLI 在 AD 中创建应用程序和 key ，然后使用它们将它们传递到二头肌和函数应用程序身份验证设置中。请注意，我将 key 保存到配置中，并使用客户端 ID 进行身份验证设置。

例如，我有一个 powershell 脚本:

param(
    [Parameter()]
    [string]$functionAppName = "functionAppName",
    [Parameter()]
    [string]$resourceGroupName = "resourceGroupName"
)

$replyUrl =  "https://$functionAppName.azurewebsites.net/.auth/login/aad/callback"

$existingApp = az ad app list --display-name $functionAppName | ConvertFrom-Json

if($existingApp.Length -eq 0) {
  $app = az ad app create --display-name $functionAppName --web-redirect-uris "$replyUrl" --enable-id-token-issuance --sign-in-audience "AzureADMyOrg" | ConvertFrom-Json
  $appId = $app.appId
} else {
  $appId = $existingApp[0].appId
}

$secret = az ad app credential reset --id $appId --years 1 --append | ConvertFrom-Json
$secretValue = $secret.password

$bicepFilePath = "path-to-bicep.bicep"

az deployment group create `
  --resource-group $resourceGroupName `
  --template-file $bicepFilePath `
  --parameters functionAppClientId=$appId functionAppClientSecret=$secretValue

二头肌:

param location string = resourceGroup().location
param functionAppName string
param functionAppClientId string
@secure()
param functionAppClientSecret string

var functionAppPlanName = '${functionAppName}-plan'
var functionAppStorageName = '${functionAppName}-storage'

// NOTE THAT YOU MIGHT WANT TO PASS THIS TENANT ID DOWN IF TENANT IS DIFFERENT FROM SUBSCRIPTION
var tenantId = subscription().tenantId

resource functionAppPlan 'Microsoft.Web/serverfarms@2021-02-01' = {
  name: functionAppPlanName
  location: location
  sku: {
    name: 'Y1'
    tier: 'Dynamic'
  }
}

resource storageAccount 'Microsoft.Storage/storageAccounts@2021-04-01' = {
  name: functionAppStorageName
  location: location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
}

resource functionApp 'Microsoft.Web/sites@2021-02-01' = {
  name: functionAppName
  location: location
  kind: 'functionapp'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    serverFarmId: functionAppPlan.id
    clientAffinityEnabled: false
    httpsOnly: true
    siteConfig: {
      appSettings: [
        {
          name: 'FUNCTIONS_WORKER_RUNTIME'
          value: 'dotnet'
        }
        {
          name: 'AzureWebJobsStorage'
          value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount.listKeys().keys[0].value};'
        }
        {
          name: 'FUNCTIONS_AUTH_AAD_SECRET'
          value: functionAppClientSecret
        }
        {
          name: 'FUNCTIONS_EXTENSION_VERSION'
          value: '~4'
        }
      ]
    }
  }
}

resource authsettings 'Microsoft.Web/sites/config@2022-03-01' = {
  parent: functionApp
  name: 'authsettingsV2'
  properties: {
    platform: {
      enabled: true
      runtimeVersion: '2'
    }
    identityProviders: {
      azureActiveDirectory: {
        enabled: true
        registration: {
          clientId: functionAppClientId
          clientSecretSettingName: 'FUNCTIONS_AUTH_AAD_SECRET'
          openIdIssuer: 'https://sts.windows.net/${tenantId}/v2.0'
        }
      }
    }
  }
}

我想指出的是，我尽可能保持简单。但最佳实践要求您实际上将客户端 key 保存到 keystore 中，然后在应用程序设置中引用该 key 。